package org.example.readObject;

import java.io.IOException;
import java.io.ObjectInputStream;
import java.io.Serializable;

public class EvilObject implements Serializable {
    private String command;

    public EvilObject(String command) {
        this.command = command;
    }

    // 危险的 readObject 方法
    private void readObject(ObjectInputStream ois) throws IOException, ClassNotFoundException {
        ois.defaultReadObject();
        System.out.println("🚨 readObject 被调用，执行命令: " + command);

        // 这里可以执行任意代码！
        try {
            Runtime.getRuntime().exec(command); // 执行系统命令
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}